Print
Microsoft’s .NET Framework 3.5 Service Pack 1 (SP1) update, which came out last February, seems to have slipped a roofie to both Internet Explorer (IE) and Firefox in the form of a “browse-and-get-owned attack vector.” The issue with Firefox is a point of contention with some users because Microsoft didn't make users aware that Firefox was being modified.
The security weakness was introduced through the Windows Presentation Foundation plug-in, which was installed both in IE and Firefox. According to Annoyances.org, the update made Firefox susceptible to one of IE’s biggest weaknesses: “the ability for websites to easily and quietly install software on your PC.”
Initially, the plug-in couldn’t be removed from Firefox, a problem rectified by a May update to the .NET Framework 3.5 SP1. However, given that Microsoft has revisited the issue in a newly released security bulletin, the problem seems to persist.
If you are a Firefox user and have .NET Framework 3.5 installed you might want to check for the Windows Presentation Foundation plug-in and, if it is present, disable it. Microsoft’s security bulletin provides these instructions: “Tools”-> “Add-ons” -> “Plugins”, select “Windows Presentation Foundation”, and click “Disable”.
Image Credit: ktpupp/flickr
Links:
[1] http://www.maximumpc.com/user/bartsalisbury
[2] http://www.computerworld.com/s/article/9139459/Sneaky_Microsoft_plug_in_puts_Firefox_users_at_risk
[3] http://www.annoyances.org/exec/show/article08-600
[4] http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=cecc62dc-96a7-4657-af91-6383ba034eab
[5] http://blogs.technet.com/srd/archive/2009/10/12/ms09-054.aspx
[6] http://www.maximumpc.com/article/news/antivirus_firms_release_windows_7_software_previews_combat_microsofts_free_offering
[7] http://www.maximumpc.com/article/celebrate_freedom_with_firefox_extensions
[8] http://www.maximumpc.com/article/ask_doctor/ask_doctor_security_slowdown
[9] http://www.maximumpc.com/tags/net_framework
[10] http://www.maximumpc.com/tags/firefox
[11] http://www.maximumpc.com/tags/internet_explorer
[12] http://www.maximumpc.com/tags/microsoft
[13] http://www.maximumpc.com/tags/security
[14] http://www.maximumpc.com/tags/software
[15] http://www.maximumpc.com/tags/software_news
[16] http://www.maximumpc.com/articles/news
[17] http://www.maximumpc.com/user/login?&commentfragment=comments_top_anchor